feat: support installing Helm charts from all sources in app store

[YanamiNeko]

Summary

Fixes #83.

The app store previously deployed apps by extracting a single container image out of a Sealos template and creating a Deployment + Service. Helm charts shown in the store could therefore never actually be installed.

This adds first-class Helm support so charts from any source can be installed and managed:

• Discovery: ArtifactHub server-side search with pagination (no longer limited to a hardcoded subset), any HTTP(S) repository via its index.yaml, and direct oci:// references.
• Values: the chart's real values.yaml is fetched and prefilled in the editor, with values.schema.json and the selectable version list returned alongside it. Input accepts YAML (and JSON, being a subset).
• Async execution: install/upgrade/uninstall run as background tasks returning a taskId; the UI polls for status and streams Helm's own log output. Long installs no longer hold the HTTP request open.
• Safety: installs and upgrades are atomic, so a failure rolls back instead of leaving partial resources behind.
• Lifecycle: a new Helm Releases page lists releases and supports upgrade and uninstall.
• Permissions: every Helm write endpoint requires admin; read endpoints require sign-in. The target namespace must already exist — it is never created implicitly.

Helm logic lives in object/helm.go and object/helm_repo.go, with controllers/ kept as a thin HTTP layer, matching the existing project structure.

New endpoints

Endpoint	Purpose
GET /api/search-helm-charts	Server-side ArtifactHub search
GET /api/get-helm-repo-charts	List charts in an arbitrary repository
GET /api/get-helm-chart-info	Chart metadata, default values, schema, versions
GET /api/get-helm-releases	List releases
GET /api/get-helm-task	Poll an async operation
POST /api/install-helm-chart	Install (async)
POST /api/upgrade-helm-release	Upgrade (async)
POST /api/uninstall-helm-release	Uninstall (async)

Test plan

• go test -tags skipCi ./...
• go build
• cd web && yarn build
• eslint on all changed frontend files
• Unit tests for values parsing (YAML/JSON/invalid input), chart reference normalization (HTTP and OCI forms), and release name validation
• Real chart smoke test: HelmRenderChart uses Helm's DryRun + ClientOnly mode to download a real chart and render its templates without needing a cluster. Verified end-to-end against charts.jetstack.io/cert-manager:
  CASOS_HELM_E2E=1 go test -tags skipCi -run TestHelmRenderChartE2E ./object/ → PASS
  This caught a genuine bug: client-only rendering defaults to Kubernetes v1.20.0, which fails any chart declaring a kubeVersion constraint. Fixed by pinning the rendering version to match the embedded control plane.
• Manual verification against a live cluster (install a chart, check the created resources, then uninstall)

Notes for reviewers

• Helm pulls in a sizeable dependency tree (helm, oras, cli-runtime, kubectl). go.sum grows accordingly.
• helm.sh/helm/v3 wants golang.org/x/crypto v0.53.0, while this repo pins v0.49.0 through replace (same for x/net and x/sys). The build is green as-is, so I left the existing replace block untouched — happy to relax it if you'd prefer.
• Not included, and probably better as follow-ups: release rollback, persisted credentials for private repositories (currently passed per-request only), and auto-generated form controls driven by values.schema.json.